{"id":"CVE-2021-23383","title":"The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.","summary":"The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.","severity":"medium","cvss":5.6,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","cwe":["CWE-1321","CWE-94"],"vendor":"handlebarsjs","product":"handlebars","affected":["handlebars < 4.7.7","e-series_performance_analyzer"],"patched":["handlebars 4.7.7"],"published":"2021-05-04","updated":"2026-10-08","sourceUpdated":"2026-10-08T22:17:07.820","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2021-23383","references":[{"url":"https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427","label":"report@snyk.io"},{"url":"https://security.netapp.com/advisory/ntap-20210618-0007/","label":"report@snyk.io"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1279031","label":"report@snyk.io"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1279032","label":"report@snyk.io"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1279030","label":"report@snyk.io"},{"url":"https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1279029","label":"report@snyk.io"},{"url":"https://github.com/handlebars-lang/handlebars.js/commit/f0589701698268578199be25285b2ebea1c1e427","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20210618-0007/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1279031","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1279032","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1279030","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://snyk.io/vuln/SNYK-JS-HANDLEBARS-1279029","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-23383.json"},{"url":"https://access.redhat.com/security/cve/CVE-2021-23383"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1956688"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-23383"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23383"},{"url":"https://access.redhat.com/errata/RHSA-2021:4628"},{"url":"https://access.redhat.com/errata/RHSA-2021:4032"},{"url":"https://access.redhat.com/errata/RHSA-2021:2500"},{"url":"https://access.redhat.com/errata/RHSA-2023:1334"}],"tags":["nvd","exploit-available","csaf","vex","red-hat","cve.org","score-dispute"],"epss":0.04506,"epssPercentile":0.9146,"exploits":{"github":2,"githubRepos":["https://github.com/dn9uy3n/Check-CVE-2021-23383","https://github.com/fazilbaig1/CVE-2021-23383"],"checkedAt":"2026-10-27T16:39:23.997Z"},"exploitAvailable":true,"ingestedAt":"2026-10-08T23:16:47.318Z","scores":{"nvd":5.6,"vendor":9.8,"cna":5.6},"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-08T21:03:53.835330Z"},"slug":"CVE-2021-23383","body":"## Overview\n\nThe package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.\n\n## Affected\n\n- `handlebars < 4.7.7`\n- `e-series_performance_analyzer`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `handlebars 4.7.7`\n\n## Vendor advisories\n\n- **RHSA-2021:4628** · Red Hat · fixed in: OpenShift Logging 5.1 · released 2021-11-17 · [advisory](https://access.redhat.com/errata/RHSA-2021:4628)\n- **RHSA-2021:4032** · Red Hat · fixed in: OpenShift Logging 5.2 · released 2021-11-17 · [advisory](https://access.redhat.com/errata/RHSA-2021:4032)\n- **RHSA-2021:2500** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.6 · released 2021-06-29 · [advisory](https://access.redhat.com/errata/RHSA-2021:2500)\n- **RHSA-2023:1334** · Red Hat · fixed in: RHPAM 7.13.1 async · released 2023-03-20 · [advisory](https://access.redhat.com/errata/RHSA-2023:1334)\n- **Red Hat VEX** · Moderate · affected: OpenShift Service Mesh 2.0, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat OpenShift Container Platform 3.11, … · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 4, Red Hat Enterprise Linux 8, … · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-23383.json)","depth":"twilight","depthScore":44,"depthScoreParts":{"impact":30.8,"likelihood":0.9,"exploitation":12,"ransomware":0},"changes":[]}